3 ms·

I have checked. Facebook does not do this.

logicallee 9y ago
how have you checked (what do you have access to). if you work for Googe on Android would be a good answer for example :)
- traek 9y ago
  From his bio: > information security research. ceo @ sudo security group (https://verify.ly https://verify.ly). > previously: founder of "Chronic Dev Team" responsible for many years of iOS jailbreaking solutions (24kPwn, absinthe, corona, greenpois0n, etc).
  - logicallee 9y ago
    I still think "how have you checked" is a fair question.
    - willstrafach 9y ago
      My company collects/analyzes apps from the App Store to test their security, so I have pretty easy access to the machine code for apps. Certainly a fair question.
- maccam94 9y ago
  On the Android side, it's not terribly difficult to send a copy of the app to a computer and decompile it. Then you can simply search for any code that invokes the Android function for mic access.
pdkl95 9y ago
> does not do this Do you have the hashes to prove that what you tested matches what is actually installed elsewhere? No, I'm not actually claiming there actually are different versions in the wild. I just find it strange that anybody can make broad claims about what widespread software may or may not be doing. Widespread use of "A/B testing" and forced remote updates should make everyone question the nature of every binary, even when they have the same name (including version number).
FridgeSeal 9y ago
Fb's well known for large scale A/B testing though. Isn't it more than possible that the binaries/versions/etc that you tested simply weren't part of the test?
- madeofpalk 9y ago
  You can't A/B test iOS app binaries though.
  - _0ffh 9y ago
    You could A/B test different app behaviour with the same binary by branching on some pseudorandom (quasi-) constant like IMEI or phone number.
    - madeofpalk 9y ago
      Sure. But once you know that everyone has the same binary, you can reverse engineer the binary you know everyone has.
    - willstrafach 9y ago
      The nice thing is that you can reverse engineer it and sniff traffic to find out what the A/B tests are and what they do.
  - Zhenya 9y ago
    Couldn't you test 2 different behaviors in the same binary thought?

how have you checked (what do you have access to). if you work for Googe on Android would be a good answer for example :)

traek 9y ago
From his bio: > information security research. ceo @ sudo security group (https://verify.ly https://verify.ly). > previously: founder of "Chronic Dev Team" responsible for many years of iOS jailbreaking solutions (24kPwn, absinthe, corona, greenpois0n, etc).
- logicallee 9y ago
  I still think "how have you checked" is a fair question.
  - willstrafach 9y ago
    My company collects/analyzes apps from the App Store to test their security, so I have pretty easy access to the machine code for apps. Certainly a fair question.
maccam94 9y ago
On the Android side, it's not terribly difficult to send a copy of the app to a computer and decompile it. Then you can simply search for any code that invokes the Android function for mic access.

pdkl95 9y ago

> does not do this Do you have the hashes to prove that what you tested matches what is actually installed elsewhere? No, I'm not actually claiming there actually are different versions in the wild. I just find it strange that anybody can make broad claims about what widespread software may or may not be doing. Widespread use of "A/B testing" and forced remote updates should make everyone question the nature of every binary, even when they have the same name (including version number).

FridgeSeal 9y ago

Fb's well known for large scale A/B testing though. Isn't it more than possible that the binaries/versions/etc that you tested simply weren't part of the test?

madeofpalk 9y ago
You can't A/B test iOS app binaries though.
- _0ffh 9y ago
  You could A/B test different app behaviour with the same binary by branching on some pseudorandom (quasi-) constant like IMEI or phone number.
  - madeofpalk 9y ago
    Sure. But once you know that everyone has the same binary, you can reverse engineer the binary you know everyone has.
  - willstrafach 9y ago
    The nice thing is that you can reverse engineer it and sniff traffic to find out what the A/B tests are and what they do.
- Zhenya 9y ago
  Couldn't you test 2 different behaviors in the same binary thought?